#Honey trap espionage definition professional#

Honeypots provide the security professional with knowledge about security issues such as new trends, tools and exploits. All packets must enter the honeypot via the firewall so logging should be implemented on this device.

If the honeypot were to get compromised then one would not want it to be used as a host to attack other hosts on the internet. What the firewall also provides is the first level of logging. For example a RedHat machine configured as a web server, tweaked to send its logs discreetly to a remote system for later analysis.Ī honeypot (or honeynet if it involves more than one honeypot) is created within a simple network and has three levels of logging which has to be implemented firewall, intrusion dectection system and system logs.Īn IDS should be used to monitor the network traffic so that the data stream can be logged for network analysis.Ī firewall should also be implemented, not to protect the honeypot itself, but to protect third-party hosts from attacks from the honeypot.

This means that a honeypot is expected to get probed, attacked and potentially exploited. Honeypots do not fix anything, but the do provide us with additional, valuable information.Ī honeypot is a basic system tweaked in order to capture attack information. Lance Spitzner, founder of the Honeynet Project, defines the term honeypot as, a resource whose value is being attacked or compromised.

In order for security professionals to better defend themselves against these types of users, we must understand what they do and how they do it. Malicious blackhat hackers are using our networks as tools. Tools to commit crime. They jump from system to system using innocent victims as their vehicle to attack and deny vital services.

Honey trap espionage definition